@mnemom/mnemom@0.17.24

Transparent AI agent tracing

AI Security Review

scanned 6h ago · by lpm-firewall-ai

The install-related manifest entry is `prepublishOnly` and runs a build. The high-signal proxy and process code is tied to an agent launch, with subscription credential forwarding requiring the interactive subscription choice; no concrete attack behavior was found.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs an agent command; remote control starts only when selected or configured and permitted by the account entitlement.

Impact

No unintended impact was confirmed; requests and the chosen authentication credential reach the gateway as part of the selected product mode.

Mechanism

The proxy routes Anthropic message requests to an HTTPS Mnemom gateway. API-key mode removes the OAuth bearer; subscription mode forwards it after the user chooses subscription authentication.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes CLI binaries; its publish hook runs a build, and the inspected prepared dependency manifests and entry files show library code rather than install-time behavior.
The CLI defaults to API-key authentication. For an interactive Team or Enterprise login, it asks whether to sign in through Mnemom with the subscription or use an API key; noninteractive launches keep API-key authentication.
The inspected session, card, skills, Slack, and handoff sources expose operations through CLI commands, editor actions, or explicit tool calls.
OAuth discovery and subscription identity handling use Mnemom gateway routes as part of the CLI's authentication flow.
The remote-control proxy requires an HTTPS gateway and routes only Anthropic message requests to it; in API-key mode it removes the OAuth bearer. The proxy starts from the agent launch path and is entitlement-gated.
OpenSSL execution is used to create the local ephemeral proxy certificate with fixed arguments; no package-controlled shell command or unrelated command-output transfer was identified.

Evidence against

The proxy performs TLS interception and can forward a Claude subscription bearer to the Mnemom gateway, which is security-sensitive; source ties this to the selected subscription mode and remote-control launch.

Source & flagged code

6 flagged

dist/rc-certs.mjsView file

Lines 1-37javascript

1// Certificate checks and leaf rotation for the Remote Control MITM proxy (rc-proxy.mjs).

2//

3// The proxy mints its CA and leaf by shelling out to whatever `openssl` is first on PATH. On macOS

4// that is often /usr/bin/openssl (LibreSSL), whose defaults differ from OpenSSL 3's: `x509 -req`

5// signs with SHA-1, and EC keys come out with explicit curve parameters. Node (OpenSSL 3) refuses

6// both — a SHA-1 leaf at https.createServer (ERR_SSL_CA_MD_TOO_WEAK), an explicit-parameter key at

7// the client's chain verification. rc-proxy.mjs pins `-sha256` and `ec_param_enc:named_curve`;

8// this module is the fail-closed check behind that pin, so an openssl that still mints something

9// Node cannot use stops the proxy with a message naming the binary, not a raw Node stack trace.

10//

11// Node 22's X509Certificate has no signatureAlgorithm getter, and it reports `namedCurve` even for

12// an explicit-parameter key, so the two properties are read from the certificate's DER directly.

14import fs from "node:fs";

15import path from "node:path";

16import tls from "node:tls";

17import crypto from "node:crypto";

18import { execFileSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/rc-certs.mjsView on unpkg · L17

20const SIG_ALGS = {

21 "2a8648ce3d0401": "ecdsa-with-SHA1",

22 "2a8648ce3d040301": "ecdsa-with-SHA224",

23 "2a8648ce3d040302": "ecdsa-with-SHA256",

24 "2a8648ce3d040303": "ecdsa-with-SHA384",

25 "2a8648ce3d040304": "ecdsa-with-SHA512",

26 "2a864886f70d010104": "md5WithRSAEncryption",

27 "2a864886f70d010105": "sha1WithRSAEncryption",

28 "2a864886f70d01010b": "sha256WithRSAEncryption",

29 "2a864886f70d01010c": "sha384WithRSAEncryption",

30 "2a864886f70d01010d": "sha512WithRSAEncryption",

31};

32const STRONG_SIG_ALGS = new Set([

33 "ecdsa-with-SHA256",

34 "ecdsa-with-SHA384",

35 "ecdsa-with-SHA512",

36 "sha256WithRSAEncryption",

37 "sha384WithRSAEncryption",

dist/lib/oauth.js#virtual:normalized:round1View file

272// Still pending (authorization_pending / slow_down) — emit a heartbeat L273: // every ~15s so a multi-minute approval doesn"t look hung.\n if (waitedMs >= nextHeartbeatMs) {\n display(`…still waiting for you to finish signing in (${Math.ro... L274: * validated (https, or http on loopback) and then passed as a separate argv

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L272

dist/rc-proxy.mjsView file

Lines 64-105javascript

64// MNEMOM_AGENT_RC_AGENT x-mnemom-agent value (required)

65// MNEMOM_AGENT_RC_CONVERSATION_ID x-mnemom-conversation-id value (required)

66// MNEMOM_AGENT_RC_CONTRACT_B64 base64 contract for x-mnemom-contract (optional)

67// MNEMOM_AGENT_RC_GOAL_MODE x-mnemom-goal-mode value (optional; `--implicit` — no contract,

68// the gateway infers the goal from the user's messages)

69// MNEMOM_AGENT_RC_SESSION_CONFIG x-mnemom-session-config value (optional; per-session env overlay, e.g. context folding off)

70// MNEMOM_AGENT_RC_PROVIDER x-mnemom-provider directive JSON (optional; router door)

71// MNEMOM_AGENT_RC_THREAD_MODE `reject` (default: answer thread-bearing requests locally,

72// see above) | `strip` (legacy: delete `thread`, forward)

dist/commands/agent-goal.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/agent-goal.js#virtual:normalized:round1View on unpkg

dist/commands/agent.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mnemom/mnemom@0.17.17 matchedIdentity = npm:QG1uZW1vbS9tbmVtb20:0.17.17 similarity = 0.814 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/agent.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/rc-certs.mjsView file

17import crypto from "node:crypto"; L18: import { execFileSync } from "node:child_process"; L19:

High

Child Process

Package source references child process execution.

dist/rc-certs.mjsView on unpkg · L17

dist/lib/oauth.js#virtual:normalized:round1View file

High

Shell

Package source references shell execution.

dist/lib/oauth.js#virtual:normalized:round1View on unpkg · L272

dist/rc-proxy.mjsView file

Findings

1 Critical5 High2 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/agent.js

HighChild Processdist/rc-certs.mjs

HighShelldist/lib/oauth.js#virtual:normalized:round1

HighSame File Env Network Executiondist/rc-proxy.mjs

HighCommand Output Exfiltrationdist/rc-proxy.mjs

HighSemantic Analysis Limiteddist/commands/agent-goal.js#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @mnemom/mnemom@0.17.24.

See all versions of @mnemom/mnemom for other recorded verdicts.

Review the evidence and your use of @mnemom/mnemom@0.17.24 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-23 00:21:36.731Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code